T08 · Insecure Dependencies
Error
- Location
scripts/package.json:6- Finding
Unverified External Dependency Executes with Trading Credentials and Authority
- Content
View full analysis
- Remediation
View remediation
Security audit
nautilus-sidecar-stops
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly for a trading stop-loss sidecar, but it asks users to run external code with wallet signing authority and gives weak safety guidance for live trading keys.
Review this carefully before installing. Use only a dedicated, low-balance exit signer, keep dry-run enabled until you have verified the policy and wallet, avoid pasting private keys into shell history or Docker environment variables, and treat the npm dependency as trusted trading software outside this skill package.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
NAUTILUS-SIDECAR.md:5- Finding
Wallet Private Key Exposed Through Shell and Container Environment Variables
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
bash mkdir -p pm-stops-sidecar && cd pm-stops-sidecar npm pack @hypelens/hypelens-agent-guard@0.1.18 && tar -xzf hypelens-hypelens-agent-guard-0.1.18.tgz cp -r package/compose/* . && rm -rf package *.tgz export FUNDER=0xYourFunder EXIT_PK=0xYourExitKey ./up.sh # or: docker compose up -d --build
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instructions reference enabling live trading by supplying EXIT_PK, which implies use of a private key for automated order execution, but there is no warning about secret handling, storage, process exposure, shell history, or least-privilege wallet segregation. In a live trading environment, unsafe credential practices can lead to wallet compromise and unauthorized trades or loss of funds.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instructions reference enabling live trading by supplying EXIT_PK, which implies use of a private key for automated order execution, but there is no warning about secret handling, storage, process exposure, shell history, or least-privilege wallet segregation. In a live trading environment, unsafe credential practices can lead to wallet compromise and unauthorized trades or loss of funds.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These instructions tell the user to export a private key and disable dry-run mode so the watcher can place live SELL orders, but they do not prominently warn about key sensitivity, wallet-drain risk, or irreversible live trading effects. In this context, the sidecar is intended to act on the same funder wallet as a live trading system, so weak safety messaging materially increases the chance of accidental credential exposure or unintended trades.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The install/run sequence again instructs the user to set
EXIT_PKand launch the watcher, but omits clear warnings that this grants live trading authority and that environment-variable handling can leak secrets through shell history, process inspection, logs, or misconfigured compose setups. Because the skill is a trading sidecar operating beside a live Nautilus node, the operational context makes accidental misuse financially dangerous rather than merely theoretical.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 85% confidence
- Finding
The unpinned
npx hypelens-agent-guardreference in the container command introduces a supply-chain risk because execution depends on the latest package version available at runtime. Given this sidecar is explicitly designed to useAGENT_GUARD_EXIT_PKto submit live exits, package drift or takeover could directly affect funds or trading behavior.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises very broad trigger terms such as 'nautilus', 'trading', 'stop loss', and related aliases without clear activation boundaries. In an agent ecosystem, this can cause the skill to be invoked in contexts the user did not explicitly intend, increasing the chance of unsolicited trading guidance or execution-adjacent setup for a real-money system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file includes concrete setup and execution commands for a live trading sidecar, including wallet configuration and running a watcher, plus a note indicating live mode via 'EXIT_PK + exits.dryRun:false', but it does not present a prominent real-money, key-handling, or system-impact warning. In this context, an agent or user could follow the commands and unintentionally enable live protective sells on an actual funded account.
- Content